GSSA-2026-04-NJB9RF2026-04-252.3 Low
Mustache HTML escaping disabled globally for the entire process
The transcript command set `Mustache.escape = text => text` at module level, disabling HTML escaping for every Mustache template in the process. Latent XSS risk if any other template is added or if the transcript is ever rendered as HTML.
The transcript command set Mustache.escape = text => text at module level, disabling HTML escaping for every Mustache template in the process and creating a latent XSS risk for any future or transitive caller that renders user content into HTML.